audit: hash chain, refused writes audited, journal copy !499

merged merged by cmc on 2026-09-28 21:50 UTC · krz/gitbay:audit-refusals-chain into main